Last Updated: 2026-08-24T19:42:12Z (UTC) What’s Happening Microsoft expands on reporting by RST Cloud on macOS infostealer infrastructure and TTPs, in which they connected over 30 additional domains to the activity. Rather than hunting on the large amount of quickly rotating domains used, Microsoft relates repeated execution patterns including request paths, headers, curl arguments, and upload parameters, tracking the malware’s entire attack chain. https://www.microsoft.com/en-us/securit...